Error after rolling restart

[khalidewaidah]

I have below error

Validating installed files against hashes from '/opt/splunk/splunk-6.5.1-f74036626f0c-linux-2.6-x86_64-manifest'
File '/opt/splunk/etc/apps/user-prefs/default/app.conf' changed.
File '/opt/splunk/etc/apps/user-prefs/default/user-prefs.conf' changed.
Problems were found, please review your files and move customizations to local

[khalidewaidah]

All of these file on search head on two file you mentioned. My questions how can i retrive the original file .

[cpetterborg]

I would suggest getting the EXACT release in tar form from the Splunk site, extract the files from the tar file and grab those two exact files from that extraction. That would be the path that I would take first.

[ddrillic]

Were these files touched today? which I doubt ; -)

File '/opt/splunk/etc/apps/user-prefs/default/app.conf' changed.
File '/opt/splunk/etc/apps/user-prefs/default/user-prefs.conf' changed.

What are their timestamps?

[khalidewaidah]

Hi
What do you mean regarding move changing to local also how can I restore original file .

Fyi we have cluster set up .

Appreciate your response.

[cpetterborg]

What was changed in the default/app.conf and default/user-prefs.conf files? Move the CHANGES to a local/app.conf and local/user-prefs.conf, restore the original files that are in the default/ directory, and try again.